Add hashclone method and implement its interface

Author: mertakman

cng/hash.go

@@ -160,7 +160,7 @@ type cloneHash interface {
 }
 
 var _ hash.Hash = (*hashX)(nil)
-var _ cloneHash = (*hashX)(nil)
+var _ HashCloner = (*hashX)(nil)
 
 // hashX implements [hash.Hash].
 type hashX struct {
@@ -201,14 +201,14 @@ func (h *hashX) init() {
 	runtime.SetFinalizer(h, (*hashX).finalize)
 }
 
-func (h *hashX) Clone() hash.Hash {
+func (h *hashX) Clone() (HashCloner, error) {
 	defer runtime.KeepAlive(h)
 	h2 := &hashX{alg: h.alg, key: bytes.Clone(h.key)}
 	if h.ctx != 0 {
 		hashClone(h.ctx, &h2.ctx)
 		runtime.SetFinalizer(h2, (*hashX).finalize)
 	}
-	return h2
+	return h2, nil
 }
 
 func (h *hashX) Reset() {

cng/hash_test.go

@@ -111,6 +111,55 @@ func TestHash(t *testing.T) {
 	}
 }
 
+func TestHash_Clone(t *testing.T) {
+	msg := []byte("testing")
+	for _, tt := range hashes {
+		t.Run(tt.String(), func(t *testing.T) {
+			if !cng.SupportsHash(tt) {
+				t.Skip("skipping: not supported")
+			}
+			h := cryptoToHash(tt)().(cng.HashCloner)
+
+			_, err := h.Write(msg)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			h3, err := h.Clone()
+			if err != nil {
+				t.Fatalf("Clone failed: %v", err)
+			}
+			prefix := []byte("tmp")
+			writeToHash(t, h, prefix)
+			h2, err := h.Clone()
+			if err != nil {
+				t.Fatalf("Clone failed: %v", err)
+			}
+			prefixSum := h.Sum(nil)
+			if !bytes.Equal(prefixSum, h2.Sum(nil)) {
+				t.Fatalf("%T Clone results are inconsistent", h)
+			}
+			suffix := []byte("tmp2")
+			writeToHash(t, h, suffix)
+			writeToHash(t, h3, append(prefix, suffix...))
+			compositeSum := h3.Sum(nil)
+			if !bytes.Equal(h.Sum(nil), compositeSum) {
+				t.Fatalf("%T Clone results are inconsistent", h)
+			}
+			if !bytes.Equal(h2.Sum(nil), prefixSum) {
+				t.Fatalf("%T Clone results are inconsistent", h)
+			}
+			writeToHash(t, h2, suffix)
+			if !bytes.Equal(h.Sum(nil), compositeSum) {
+				t.Fatalf("%T Clone results are inconsistent", h)
+			}
+			if !bytes.Equal(h2.Sum(nil), compositeSum) {
+				t.Fatalf("%T Clone results are inconsistent", h)
+			}
+		})
+	}
+}
+
 func TestHash_Interface(t *testing.T) {
 	for _, tt := range hashes {
 		t.Run(tt.String(), func(t *testing.T) {
@@ -264,3 +313,20 @@ func BenchmarkSHA256_OneShot(b *testing.B) {
 		cng.SHA256(buf)
 	}
 }
+
+// Helper function for writing. Verifies that Write does not error.Add commentMore actions
+func writeToHash(t *testing.T, h hash.Hash, p []byte) {
+	t.Helper()
+
+	before := make([]byte, len(p))
+	copy(before, p)
+
+	n, err := h.Write(p)
+	if err != nil || n != len(p) {
+		t.Errorf("Write returned error; got (%v, %v), want (nil, %v)", err, n, len(p))
+	}
+
+	if !bytes.Equal(p, before) {
+		t.Errorf("Write modified input slice; got %x, want %x", p, before)
+	}
+}

cng/hashclone.go

@@ -0,0 +1,18 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//go:build windows
+// +build windows
+
+package cng
+
+import (
+	"hash"
+)
+
+// HashCloner is an interface that defines a Clone method.
+type HashCloner interface {
+	hash.Hash
+	// Clone returns a separate Hash instance with the same state as h.
+	Clone() (HashCloner, error)
+}

cng/hashclone_go125.go

@@ -0,0 +1,13 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//go:build go1.25 && windows
+// +build go1.25,windows
+
+package cng
+
+import (
+	"hash"
+)
+
+type HashCloner = hash.Cloner